New FCSS_EFW_AD-7.4 Exam Dumps (V8.02) – Helping You Pass the Fortinet FCSS – Enterprise Firewall 7.4 Administrator Certification Exam

1. An administrator must ensure that users cannot access sites containing malware and spyware, while also protecting them from phishing attempts.

What is the most resource-efficient method to block access to these sites?

2. What global configuration setting changes the behavior for content-inspected traffic while FortiGate is in system conserve mode?

3. Examine the following traffic log; then answer the question below.

date-20xx-02-01 time=19:52:01 devname=masterdevice_id="xxxxxxx" log_id=0100020007 type=event subtype=system pri critical vd=root service=kemel status=failure msg="NAT port is exhausted."

What does the log mean?

4. Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.

Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

5. Refer to the exhibit, which shows a partial web filter profile configuration.

Which action will FortiGate take if a user attempts to access www.dropbox.com, which is categorized as File Sharing and Storage?

6. Refer to the exhibit, which shows partial outputs from two routing debug commands.

Why is the port2 default route not in the second command output?

7. How does FortiManager handle FortiGuard requests from FortiGate devices, when it is configured as a local FDS?

8. An administrator has configured a dial-up IPsec VPN with one phase 2, extended authentication (XAuth) and IKE mode configuration.

The administrator has also enabled the IKE real time debug:

diagnose debug application ike-1

diagnose debug enable

In which order is each step and phase displayed in the debug output each time a new dial-up user is connecting to the VPN?

9. View the exhibit, which contains the partial output of a diagnose command, and then answer the question below.

Based on the output, which of the following statements is correct?

10. Which statement about the designated router (DR) and backup designated router (BDR) in an OSPF multi-access network is true?

11. Which two statements about application layer test commands are true? (Choose two.)

12. Refer to the exhibit, which shows the output of a diagnose command.

What can you conclude from the output shown in the exhibit? (Choose two.)

13. When investigating FortiGuard connectivity issues, which action is a valid troubleshooting step?

14. In which two states is a given session categorized as ephemeral? (Choose two.)

15. Refer to the exhibit, which contains the partial output of an IKE real-time debug.

Why did the tunnel not come up?

16. Which statement about administrative domains (ADOMs) on FortiManager is true?

17. Refer to the exhibits.

The exhibits show a network diagram, the output from the command config system ha, and a firewall policy.

What source MAC address does the web server detect when a user accesses it?

18. Which two statements about the Security Fabric are true? (Choose two.)

19. Examine the output from the 'diagnose debug authd fsso list' command; then answer the question below.

# diagnose debug authd fsso list--FSSO logons-IP: 192.168.3.1 User: STUDENT Groups:TRAININGAD/USERS Workstation: INTERNAL2. TRAINING. LAB The IP address 192.168.3.1 is NOT the one used by the workstation INTERNAL2. TRAINING. LAB.

What should the administrator check?

20. Four FortiGate devices configured for OSPF connected to the same broadcast domain. The first unit is elected as the designated router.

The second unit is elected as the backup designated router.

Under normal operation, how many OSPF full adjacencies are formed to each of the other two units?

21. An administrator has enabled HA session synchronization in a HA cluster with two members.

Which flag is added to a primary unit’s session to indicate that it has been synchronized to the secondary unit?

22. Which two tasks are automated using the Install Wizard on FortiManager? (Choose two.)

23. Refer to the exhibit, which contains a session table entry.

Which statement about FortiGate inspection of this session is true?

24. An LDAP user cannot authenticate against a FortiGate device.

Examine the real time debug output shown in the exhibit when the user attempted the authentication; then answer the question below.

Based on the output in the exhibit, what can cause this authentication problem?

25. Refer to the exhibit, which contains the output of a web filtering diagnose command.

Which statement explains why the cache statistics are all zeros?

26. Refer to the exhibit, which contains partial output from an IKE real-time debug.

Based on the debug output, which phase 1 setting is enabled in the configuration of this VPN?

27. An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates,

What command should the administrator execute?

28. What are two impacts on applications if adjusting the TCP Maximum Segment Size (MSS) on FortiGate? (Choose two.)

29. Which of the following statements is true regarding a FortiGate configured as an explicit web proxy?

30. Which statement about memory conserve mode is true?

31. Examine the partial output from the IKE real time debug shown in the exhibit; then answer the question below.

Why didn’t the tunnel come up?

32. When investigating FortiGuard connectivity issues, which of the following is a valid troubleshooting step?

33. Refer to the exhibit, which shows the output of a diagnose command

What can you conclude from the RTT value?

34. Examine the following routing table and BGP configuration; then answer the question below.

The BGP connection is up, but the local peer is NOT advertising the prefix 192.168.1.0/24.

Which configuration change will make the local peer advertise this prefix?

35. What configuration changes can reduce the memory utilization in a FortiGate? (Choose two.)

36. Refer to the exhibit, which shows the output of a web filtering diagnose command.

Which configuration change would result in non-zero results in the cache statistics section?

37. Refer to the exhibit, which contains a partial routing table.

Assuming all the appropriate firewall policies are configured, which two pings will FortiGate route? (Choose two.)

38. Which three conditions are required for two FortiGate devices to form an OSP adjacency? (Choose three.)

39. Refer to the exhibit, which shows partial outputs from two routing debug commands.

Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?

40. Examine the partial output from two web filter debug commands; then answer the question below:

Based on the above outputs, which is the FortiGuard web filter category for the web site www.fgt99.com?

41. Which configuration can be used to reduce the number of BGP sessions in an IBGP network?

42. Examine the output from the ‘diagnose vpn tunnel list’ command shown in the exhibit; then answer the question below.

Which command can be used to sniffer the ESP traffic for the VPN DialUP_0?

43. Refer to the exhibit, which shows the output of a debug command.

Which two statements about the output are true? (Choose two.)

44. View the exhibit, which contains the output of a diagnose command, and then answer the question below.

What statements are correct regarding the output? (Choose two.)

45. Refer to the exhibit, which contains the partial output of the get vpn ipsec tunnel details command.

Based on the output, which two statements are correct? (Choose two.)

46. Examine the output from the BGP real time debug shown in the exhibit, then the answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

47. Which of the following troubleshooting steps is applicable when investigating antivirus and IPS update issues on FortiGate?

48. Which layer of the FortiOS architecture does an application process or daemon run on?

49. View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which one of the following statements describes why the update is failing?

50. Which of the following tasks are part of the manual registration process for adding a FortiGate to a FortiManager for central management? (Choose three.)

51. Examine the output of the 'diagnose debug rating' command shown in the exhibit; then answer the question below.

Which statement are true regarding the output in the exhibit? (Choose two.)

52. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statement can explain why the state of the remote BGP peer 10.200.3.1 is Connect?

53. View the exhibit, which contains the output of a real-time debug, and then answer the question below.

Which of the following statements is true regarding this output? (Choose two.)

54. View the following FortiGate configuration.

All traffic to the Internet currently egresses from port1.

The exhibit shows partial session information for Internet traffic from a user on the internal network:

If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user’s session?

55. Refer to the exhibit, which contains the output of the diagnose vpn tunnel list.

Which command will capture ESP traffic for the VPN named DialUp_0?

56. Examine the following partial output from a sniffer command; then answer the question below.

What is the meaning of the packets dropped counter at the end of the sniffer?

57. Which of the following statements are correct regarding application layer test commands? (Choose two.)

58. Examine the output of the ‘get router info bgp summary’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the output in the exhibit? (Choose two.)

59. Which two statements about an auxiliary session are true? (Choose two.)

60. What is an OSPF area border router?

61. What is the diagnose test application ipsmenitor 5 command used for?

62. Examine the output of the ‘get router info ospf interface’ command shown in the exhibit; then answer the question below.

Which statements are true regarding the above output? (Choose two.)

63. A corporate network allows internet Access to FSSO users only. The FSSO user student does not have internet access after successfully logged into the Windows AD network.

The output of the ‘diagnose debug authd fsso list’ command does not show student as an active FSSO user. Other FSSO users can access the Internet without problems.

What should the administrator check? (Choose two.)

64. What action does FortiSwitch take when it receives a loop guard data packet (LGDP) that was sent by itself?

65. An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.

What can the administrator do to fix this problem?

66. View the exhibit, which of the contains the partial output of an IKE real-time debug, then answer the question below.

Which of the following statements about this debug output are true? (Choose two.)

67. Which two statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)

68. View the exhibit, which contains the output of get sys ha status, and then answer the question below.

Which statements are correct regarding the output? (Choose two.)

69. A FortiGate device has the following LDAP configuration:

The administrator executed the ‘dsquery’ command in the Windows LDAp server 10.0.1.10, and got the following output:

>dsquery user -samid administrator

"CN-Administrator, CN-Users, DC=trainingAD, DC-training, DC-lab"

Based on the output, what FortiGate LDAP setting is configured incorrectly?

70. View the exhibit, which contains a session entry, and then answer the question below.

Which statement is correct regarding this session?

71. Which two statements about the use of digital certificates are true?

72. An administrator has configured a FortiGate device with two VDOMs: root and internal.

The administrator has also created and inter-VDOM link that connects both VDOMs. The objective is to have each VDOM advertise some routes to the other VDOM via OSPF through the inter-VDOM link.

What OSPF configuration settings must match in both VDOMs to have the OSPF adjacency successfully forming? (Choose three.)

73. Which statement is true regarding File description (FD) conserve mode?

74. View the exhibit, which contains the partial output of an IKE real time debug, and then answer the question below.

The administrator does not have access to the remote gateway.

Based on the debug output, what configuration changes can the administrator make to the local gateway to resolve the phase 1 negotiation error?

75. View the following exhibit, which contains the sniffer output for a passive mode FTP request.

An administrator has created the following custom IPS signature to block all FTP requests for passive mode: F-SBID (--attack_id 1002; --name "Block.FTP "; --protocol tcp; --flow from_client; --pattern "PASV"; --no_case;) Soon after the signature is enabled in an active IPS sensor, some false positive detections are generated.

Which option and value pair will allow more specific detection?

76. Examine these partial outputs from two routing debug commands:

# get router info routing-table database

S 0.0.0.0/0 [20/0] via 100.64.2.254, port2, [10/0]

S *> 0.0.0.0/0 [10/0] via 100.64.1.254, port1

# get router info routing-table all

S* 0.0.0.0/0 [10/0] via 100.64.1.254, port1

Why is the default route that uses port2 not in the output of the second command?

77. View the exhibit, which contains the output of a debug command, and then answer the question below.

Which one of the following statements about this FortiGate is correct?

78. View the following exhibit:

What two statements about this session are correct? (Choose two.)

79. An administrator wants to capture encrypted phase 2 traffic between two FortiGate devices using the built-in sniffer.

If the administrator knows that there is no NAT device located between both FortiGate devices, which command should the administrator run?

80. Refer to the exhibit, which contains the output of a diagnose command.

Which two statements about the output are true? (Choose two.)